john-users - Re: Need help with hashes from isocode plaintext

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 5 Nov 2012 20:56:52 -0800 (PST)
From: wfdawson <wfdawson@...lsouth.net>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: Re: Need help with hashes from isocode plaintext

Before I get too excited about being done with this question:


> $ echo -n geländerxx | iconv -t utf-8 | md5sum 
> 2bfba679d5817bd26fef35e70a07f00a
> 
> OK, so it's not UTF-8. My second guess would be cp1252 or iso-8859-1 (they are the same for this letter):
> 
> $ echo -n geländerxx | iconv -t iso-8859-1 | md5sum 
> 005f3942106f3bc5a392dcde686d87f0
> 
> There you have it. Note the '-n' option to echo. Without it you will get a totally different MD5 because you will include a linefeed in the hashed string.

That helped - most of the hashes from that dump were cracked with that approach.  But, it turns out that didn't work for every hash/plaintext from that collection.

073f41b35f29de5ac019276c204ba16d:frühkÃ¶lsch
1855b398f0e7733df11185183822b424:à¸‹à¸²à¸¥à¸²à¹€à¸›à¸²
1d9d908be226f034ed2cf29f956b1277:Ð³Ð°Ñ€Ð¼Ð¾Ð½Ð¸Ñ
2613f4d166ce5198ac1c8cc792afd584:123456Ð¹Ñ†ÑƒÐºÐµÐ½Ð³
2f2d2f5b0cf72f9d4e21a2c9f15ea92b:ÄŸÄŸÄŸÄŸÄŸÄŸÄŸÄŸ
42d4022d1111ff87c7594f2208ba32de:Ð°Ð»ÐµÐºÑÐ°Ð½Ð´Ñ€Ð°

I blindly tried every output type supported by iconv on my system (1173); nothing matched the hashes given.  Another approach for these hashes?

And, another weirdness:

h:
2202:10425bb1692fdbc45c6959cc668921d5

$ john --show --format=raw-md5 h
0 password hashes cracked, 1 left

$ grep 10425bb1692fdbc45c6959cc668921d5 ~/.john/john.pot
10425bb1692fdbc45c6959cc668921d5:emileebby

Nothing unusual about the plaintext there.  Strange result...